You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2018/10/05 15:15:09 UTC
[cxf] branch master updated (d687350 -> 1431456)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from d687350 Allow more customization of Operation responses
new 86d7c65 Remove default ciphersuite filter inclusion (which isn't used anyway)
new e60e8ab CXF-7865 - Enable default ciphersuites exclusion filter
new a9c0c77 CXF-7866 - Exclude DES, 3DES, MD5, CBC and RC4 ciphersuites as well by default
new 1431456 Optimise the ciphersuite filtering
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/cxf/configuration/jsse/SSLUtils.java | 98 ++++++++++++----------
.../https/ciphersuites/CipherSuitesTest.java | 54 ++++++++++++
2 files changed, 109 insertions(+), 43 deletions(-)
[cxf] 04/04: Optimise the ciphersuite filtering
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 143145643b3bb2f0a7ba97ec216bc59de754fd94
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Oct 5 16:14:16 2018 +0100
Optimise the ciphersuite filtering
---
.../apache/cxf/configuration/jsse/SSLUtils.java | 31 +++++++++-------------
1 file changed, 12 insertions(+), 19 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
index 6446719..f6c4963 100644
--- a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
+++ b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
@@ -422,34 +422,27 @@ public final class SSLUtils {
}
List<String> filteredCipherSuites = new ArrayList<>();
- List<String> excludedCipherSuites = new ArrayList<>();
- for (int i = 0; i < supportedCipherSuites.length; i++) {
- if (matchesOneOf(supportedCipherSuites[i], includes)
- && !matchesOneOf(supportedCipherSuites[i], excludes)) {
+ for (String supportedCipherSuite : supportedCipherSuites) {
+ if (matchesOneOf(supportedCipherSuite, includes)
+ && !matchesOneOf(supportedCipherSuite, excludes)) {
LogUtils.log(log,
Level.FINE,
"CIPHERSUITE_INCLUDED",
- supportedCipherSuites[i]);
- filteredCipherSuites.add(supportedCipherSuites[i]);
+ supportedCipherSuite);
+ if (!exclude) {
+ filteredCipherSuites.add(supportedCipherSuite);
+ }
} else {
LogUtils.log(log,
Level.FINE,
"CIPHERSUITE_EXCLUDED",
- supportedCipherSuites[i]);
- excludedCipherSuites.add(supportedCipherSuites[i]);
+ supportedCipherSuite);
+ if (exclude) {
+ filteredCipherSuites.add(supportedCipherSuite);
+ }
}
}
- LogUtils.log(log,
- Level.FINE,
- "CIPHERSUITES_FILTERED",
- filteredCipherSuites);
- LogUtils.log(log,
- Level.FINE,
- "CIPHERSUITES_EXCLUDED",
- excludedCipherSuites);
- if (exclude) {
- return getCiphersFromList(excludedCipherSuites, log, exclude);
- }
+
return getCiphersFromList(filteredCipherSuites, log, exclude);
}
[cxf] 03/04: CXF-7866 - Exclude DES, 3DES, MD5,
CBC and RC4 ciphersuites as well by default
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit a9c0c7705f70054a70eb3e95439d2a37731e0332
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Oct 5 14:16:15 2018 +0100
CXF-7866 - Exclude DES, 3DES, MD5, CBC and RC4 ciphersuites as well by default
---
.../src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java | 8 ++++++--
.../apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java | 2 +-
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
index ed79a51..6446719 100644
--- a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
+++ b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
@@ -67,12 +67,16 @@ public final class SSLUtils {
private static final String HTTPS_CIPHER_SUITES = "https.cipherSuites";
/**
- * By default, exclude NULL, anon and EXPORT ciphersuites
+ * By default, exclude NULL, anon, EXPORT, (3)DES, MD5, CBC and RC4 ciphersuites
*/
private static final List<String> DEFAULT_CIPHERSUITE_FILTERS_EXCLUDE =
Arrays.asList(new String[] {".*NULL.*",
".*anon.*",
- ".*EXPORT.*"});
+ ".*EXPORT.*",
+ ".*DES.*",
+ ".*MD5",
+ ".*CBC.*",
+ ".*RC4.*"});
private static volatile KeyManager[] defaultManagers;
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
index 7a4c54b..24f3904 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
@@ -688,7 +688,7 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
// Check we have no anon/EXPORT/NULL/etc ciphersuites
assertFalse(Arrays.stream(
- filteredCipherSuites).anyMatch(c -> c.matches(".*NULL|anon|EXPORT.*")));
+ filteredCipherSuites).anyMatch(c -> c.matches(".*NULL|anon|EXPORT|DES|MD5|CBC|RC4.*")));
}
@org.junit.Test
[cxf] 02/04: CXF-7865 - Enable default ciphersuites exclusion filter
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit e60e8ab5d7414a0dc581c5666873e1ab0413b107
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Oct 5 14:09:59 2018 +0100
CXF-7865 - Enable default ciphersuites exclusion filter
---
.../apache/cxf/configuration/jsse/SSLUtils.java | 62 ++++++++++++++--------
.../https/ciphersuites/CipherSuitesTest.java | 54 +++++++++++++++++++
2 files changed, 93 insertions(+), 23 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
index de573d8..ed79a51 100644
--- a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
+++ b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
@@ -31,12 +31,12 @@ import java.security.KeyStore;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.Arrays;
-import java.util.Collections;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+import java.util.stream.Collectors;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
@@ -67,17 +67,12 @@ public final class SSLUtils {
private static final String HTTPS_CIPHER_SUITES = "https.cipherSuites";
/**
- * By default, exclude NULL, anon, EXPORT, DES, 3DES, MD5, CBC and RC4 ciphersuites
+ * By default, exclude NULL, anon and EXPORT ciphersuites
*/
private static final List<String> DEFAULT_CIPHERSUITE_FILTERS_EXCLUDE =
- Arrays.asList(new String[] {".*_NULL_.*",
- ".*_anon_.*",
- ".*_EXPORT_.*",
- ".*_DES_.*",
- ".*_3DES_.*",
- ".*_MD5",
- ".*_CBC_.*",
- ".*_RC4_.*"});
+ Arrays.asList(new String[] {".*NULL.*",
+ ".*anon.*",
+ ".*EXPORT.*"});
private static volatile KeyManager[] defaultManagers;
@@ -403,16 +398,27 @@ public final class SSLUtils {
String[] supportedCipherSuites,
Logger log, boolean exclude) {
// We have explicit filters, so use the "include/exclude" cipherSuiteFilter configuration
+ List<Pattern> includes = new ArrayList<>();
+ List<Pattern> excludes = new ArrayList<>();
+
+ if (filters != null) {
+ // We must have an inclusion pattern specified or no ciphersuites are filtered
+ compileRegexPatterns(includes, filters.getInclude(), true, log);
+
+ if (filters.isSetExclude()) {
+ // If we have specified excludes, then the default excludes are ignored
+ compileRegexPatterns(excludes, filters.getExclude(), false, log);
+ } else {
+ // Otherwise use the default excludes, but remove from the default excludes any
+ // ciphersuites explicitly matched by the inclusion filters
+ List<String> filteredExcludes =
+ filterDefaultExcludes(filters.getInclude(), DEFAULT_CIPHERSUITE_FILTERS_EXCLUDE);
+ compileRegexPatterns(excludes, filteredExcludes, false, log);
+ }
+ }
+
List<String> filteredCipherSuites = new ArrayList<>();
List<String> excludedCipherSuites = new ArrayList<>();
- List<Pattern> includes =
- filters != null
- ? compileRegexPatterns(filters.getInclude(), true, log)
- : Collections.emptyList();
- List<Pattern> excludes =
- filters != null
- ? compileRegexPatterns(filters.getExclude(), false, log)
- : compileRegexPatterns(DEFAULT_CIPHERSUITE_FILTERS_EXCLUDE, true, log);
for (int i = 0; i < supportedCipherSuites.length; i++) {
if (matchesOneOf(supportedCipherSuites[i], includes)
&& !matchesOneOf(supportedCipherSuites[i], excludes)) {
@@ -443,6 +449,19 @@ public final class SSLUtils {
return getCiphersFromList(filteredCipherSuites, log, exclude);
}
+ private static List<String> filterDefaultExcludes(List<String> includes, List<String> defaultExcludes) {
+ if (includes != null && !includes.isEmpty()) {
+ // Filter the default exclusion filters to remove any that explicitly match the inclusion filters
+ // e.g. if the user wants the NULL ciphersuite then remove it from the default excludes
+ return defaultExcludes.stream()
+ .filter(ex -> !includes.stream()
+ .anyMatch(inc -> inc.matches(ex)))
+ .collect(Collectors.toList());
+ }
+
+ return defaultExcludes;
+ }
+
private static String[] getSystemCiphersuites(Logger log) {
String jvmCipherSuites = System.getProperty(HTTPS_CIPHER_SUITES);
if ((jvmCipherSuites != null) && (!jvmCipherSuites.isEmpty())) {
@@ -453,10 +472,8 @@ public final class SSLUtils {
}
- private static List<Pattern> compileRegexPatterns(List<String> regexes,
- boolean include,
- Logger log) {
- List<Pattern> patterns = new ArrayList<>();
+ private static void compileRegexPatterns(List<Pattern> patterns, List<String> regexes,
+ boolean include, Logger log) {
if (regexes != null) {
String msg = include
? "CIPHERSUITE_INCLUDE_FILTER"
@@ -466,7 +483,6 @@ public final class SSLUtils {
patterns.add(Pattern.compile(s));
}
}
- return patterns;
}
private static boolean matchesOneOf(String s, List<Pattern> patterns) {
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
index 9503101..7a4c54b 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
@@ -22,11 +22,13 @@ package org.apache.cxf.systest.https.ciphersuites;
import java.net.URL;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
+import java.util.Arrays;
import java.util.Collections;
import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
+import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import javax.xml.ws.BindingProvider;
@@ -34,7 +36,10 @@ import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
import org.apache.cxf.BusFactory;
import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.cxf.configuration.jsse.SSLUtils;
import org.apache.cxf.configuration.jsse.TLSClientParameters;
+import org.apache.cxf.configuration.security.FiltersType;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.helpers.JavaUtils;
@@ -670,6 +675,55 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
+ @org.junit.Test
+ public void testDefaultCipherSuitesFilterExcluded() throws Exception {
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, null, new java.security.SecureRandom());
+
+ FiltersType filtersType = new FiltersType();
+ filtersType.getInclude().add(".*_AES_.*");
+ String[] supportedCipherSuites = sslContext.getSocketFactory().getSupportedCipherSuites();
+ String[] filteredCipherSuites = SSLUtils.getFilteredCiphersuites(filtersType, supportedCipherSuites,
+ LogUtils.getL7dLogger(CipherSuitesTest.class), false);
+
+ // Check we have no anon/EXPORT/NULL/etc ciphersuites
+ assertFalse(Arrays.stream(
+ filteredCipherSuites).anyMatch(c -> c.matches(".*NULL|anon|EXPORT.*")));
+ }
+
+ @org.junit.Test
+ public void testExclusionFilter() throws Exception {
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, null, new java.security.SecureRandom());
+
+ FiltersType filtersType = new FiltersType();
+ filtersType.getInclude().add(".*_AES_.*");
+ filtersType.getExclude().add(".*anon.*");
+ String[] supportedCipherSuites = sslContext.getSocketFactory().getSupportedCipherSuites();
+ String[] filteredCipherSuites = SSLUtils.getFilteredCiphersuites(filtersType, supportedCipherSuites,
+ LogUtils.getL7dLogger(CipherSuitesTest.class), false);
+
+ // Check we have no anon ciphersuites
+ assertFalse(Arrays.stream(
+ filteredCipherSuites).anyMatch(c -> c.matches(".*anon.*")));
+ }
+
+ @org.junit.Test
+ public void testInclusionFilter() throws Exception {
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, null, new java.security.SecureRandom());
+
+ FiltersType filtersType = new FiltersType();
+ filtersType.getInclude().add(".*anon.*");
+ String[] supportedCipherSuites = sslContext.getSocketFactory().getSupportedCipherSuites();
+ String[] filteredCipherSuites = SSLUtils.getFilteredCiphersuites(filtersType, supportedCipherSuites,
+ LogUtils.getL7dLogger(CipherSuitesTest.class), false);
+
+ // Check we have anon ciphersuites
+ assertTrue(Arrays.stream(
+ filteredCipherSuites).anyMatch(c -> c.matches(".*anon.*")));
+ }
+
private static class NoOpX509TrustManager implements X509TrustManager {
NoOpX509TrustManager() {
[cxf] 01/04: Remove default ciphersuite filter inclusion (which
isn't used anyway)
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 86d7c657499b73bdbbd6ba9f1579e76ca0715357
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Oct 5 10:56:21 2018 +0100
Remove default ciphersuite filter inclusion (which isn't used anyway)
---
core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
index 9d8467b..de573d8 100644
--- a/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
+++ b/core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java
@@ -31,6 +31,7 @@ import java.security.KeyStore;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.Arrays;
+import java.util.Collections;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -65,8 +66,6 @@ public final class SSLUtils {
private static final String HTTPS_CIPHER_SUITES = "https.cipherSuites";
- private static final List<String> DEFAULT_CIPHERSUITE_FILTERS_INCLUDE =
- Arrays.asList(new String[] {".*"});
/**
* By default, exclude NULL, anon, EXPORT, DES, 3DES, MD5, CBC and RC4 ciphersuites
*/
@@ -409,7 +408,7 @@ public final class SSLUtils {
List<Pattern> includes =
filters != null
? compileRegexPatterns(filters.getInclude(), true, log)
- : compileRegexPatterns(DEFAULT_CIPHERSUITE_FILTERS_INCLUDE, true, log);
+ : Collections.emptyList();
List<Pattern> excludes =
filters != null
? compileRegexPatterns(filters.getExclude(), false, log)